Solid Security vs. Kakapo Security: Hardening Compared
Solid Security — formerly iThemes Security — and Kakapo Security solve the same task with different emphases. One is strong on login and hardening; the other adds a transparent scan and a log that shows whether it has been changed.
The short answer
Solid Security is an established tool with many hardening toggles, login protection, two-factor via authenticator apps, and a free version. It's widely used, well documented, and sufficient for most sites.
Kakapo Security brings the same basics — limiting failed attempts, moving the login URL, sessions, hardening — and adds a pattern firewall, a scan, and a chained log entry on top. Everything runs locally; nothing is queried for detection.
In short: if you need two-factor via an app and a free starting point, Solid Security is the obvious choice. If you want to read what it scans for and have a log that makes tampering visible, Kakapo Security is the better fit.
What both can do
- Limit failed attempts and block addresses
- Moving the login URL
- Harden user accounts, disable file editing in the backend
- Detect file changes
- Logs of logins and lockouts
- Notifications by email
Where the two differ
| Question | Solid Security | Kakapo Security |
|---|---|---|
| Price | free, with a Pro tier | paid plugin, one license for nine |
| Two-factor authentication | Authenticator app (TOTP) | email code only |
| Pattern firewall in the plugin | check | 40 patterns, readable in the source code |
| Scan of wp-content | depends on plan | 22 patterns, rejected approaches documented |
| Core files against the original | yes | yes, against api.wordpress.org |
| Approving a finding | possible | tied to the file's checksum |
| Tamper-proof log chain | — | yes, against a value from wp-config.php |
| Country block at login | depends on plan | built in |
| Login window (times of day) | — | built in |
| Does anything go through the vendor? | check | no |
The most important difference: transparency
A security tool can only be judged if you know what it's looking for. In Kakapo Security, the firewall and scan patterns are in the shipped source code — along with a list of approaches that, when measured, produced too many false positives, each with its count.
That's not a marketing claim but something you can verify: the list is shown in the interface. If you want to know why a pattern is missing, you'll find the reasoning there instead of a gap.
Two security plugins at once aren't double security. They lock each other out, duplicate logs, and make every alert ambiguous. One is enough — set up correctly.
When Solid Security is the better choice
- You need two-factor with an authenticator app
- You want to start for free
- You're looking for a very widely used tool with lots of tutorials
When Kakapo Security is the better choice
- You want to be able to read what it scans for
- Nothing should go to a security service
- You need a log that shows whether it has been changed
- You want a login window or a country block without an add-on tier
- You look after multiple sites under one license
Switching: what to do
- Write down block lists, exceptions, and the custom login URL. The last one first — if you forget it, you'll lock yourself out.
- Install Kakapo Security and enter your license key.
- Set the firewall to “Monitor” and let it run alongside for a week.
- Go through the log and loosen rules that hit real traffic.
- Take a baseline of the files while the site is verifiably clean.
- Switch off the old plugin, and only then switch to “Block”.
Frequently asked questions
Will I lose my block lists?
What about the custom login URL?
Do I still need two-factor via an app?
What happens without a valid license?
Kakapo Security — pay once, use forever.
All nine plugins for €149 once instead of €13 a month. Secure payment via Stripe. For the first 14 days: problem fixed or money back.
Get Lifetime All Features